MTA-STS really is a drag. Baking in dependencies on a web server and web PKI is a true drag. Such web infrastructure has different operational profiles/modes of resilience that it’s a real impedance mismatch for those who can’t or don’t want to manage a highly-available web server.